{ config, lib, pkgs, ... }:

with lib;
let
  hostname = "legatus";
  host-ipv4 = "190.2.136.47";
  domain-name = config.fudo.hosts.${hostname}.domain;
  domain = config.fudo.domains.${domain-name};
  site-name = config.fudo.hosts.${hostname}.site;
  site = config.fudo.sites.${site-name};

  local-packages = with pkgs; [ ldns.examples ];

  host-secrets = config.fudo.secrets.host-secrets.${hostname};

in {
  networking = {
    enableIPv6 = true;

    nameservers = [ "1.1.1.1" ];
    defaultGateway = {
      address = site.gateway-v4;
      interface = "extif0";
    };

    interfaces.extif0.ipv4.addresses = [{
      address = host-ipv4;
      prefixLength = 24;
    }];
  };

  # Getting errors due to running VMs
  boot.kernel.sysctl."fs.inotify.max_user_instances" = 512;

  security.acme.defaults.email = "admin@legatus.fudo.org";

  systemd.tmpfiles.rules = [
    "L /etc/adjtime - - - - /state/etc/adjtime"
    "d /state/services/podman/volumes 0700 root root - -"
    "d /state/services/acme 0755 acme acme - -"
  ];

  fileSystems = {
    "/var/lib/acme" = {
      device = "/state/services/acme";
      options = [ "bind" ];
    };
  };

  environment.systemPackages = local-packages;

  # networking.firewall.allowedTCPPorts = [ 80 443 ];

  # informis.cl-gemini = {
  #   enable = true;

  #   hostname = "gemini.fudo.org";
  #   server-ip = host-ipv4;
  #   document-root = "/state/gemini/root";
  #   # textfiles-archive = "${pkgs.textfiles}";
  #   slynk-port = 4005;
  # };

  services = {
    mastodonContainer.state-directory = "/state/services/mastodon";
    lemmyDocker = {
      enable = true;
      hostname = "lemmy.fudo.org";
      site-name = "Fudo Lemmy";
      version = "0.18";
      state-directory = "/state/services/lemmy";
      smtp-server = "mail.fudo.org:587";
      docker-images = {
        pictrs = "asonix/pictrs:0.4";
        postgres = "postgres:15-alpine";
      };
    };
    authentikContainer.state-directory = "/state/services/authentik";
    nextcloudContainer.state-directory = "/state/services/nextcloud";
    nginx.virtualHosts."fudo.org" = {
      enableACME = true;
      forceSSL = true;
    };
  };

  virtualisation = {
    arion.backend = "podman-socket";
    podman = {
      enable = true;
      dockerSocket.enable = true;
      autoPrune.enable = true;
    };
  };

  fudo = {
    hosts.legatus.external-interfaces = [ "extif0" ];

    services = {
      auth = {
        ldap.state-directory = "/state/auth/ldap";
        kerberos = {
          state-directory = "/state/auth/kerberos";
          # master-key-file = host-secrets.heimdal-master-key.target-file;
          # ipropd-keytab = host-secrets.heimdal-ipropd-keytab.target-file;
        };
      };

      chat = {
        state-directory = "/state/services/chat";
        external-interface = "extif0";
      };

      nexus.dns-server.listen-addresses = [ host-ipv4 ];

      # lemmy = {
      #   enable = true;
      #   hostname = "lemmy.fudo.org";
      # };

      matrix.state-directory = "/state/services/matrix";
    };

    secrets.host-secrets.legatus = let files = config.fudo.secrets.files;
    in {
      # postgres-keytab = {
      #   source-file = files.service-keytabs.procul.postgres;
      #   target-file = "/srv/postgres/secure/postgres.keytab";
      #   user = "root";
      # };

      # gitea-database-password = {
      #   source-file = files.service-passwords.procul.gitea-database;
      #   target-file = "/srv/gitea/secure/database.passwd";
      #   user = config.fudo.git.user;
      # };

      # heimdal-master-key = {
      #   source-file = files.realm-master-keys."FUDO.ORG";
      #   target-file = "/run/heimdal/master-key";
      #   user = config.fudo.auth.kdc.user;
      # };

      # heimdal-ipropd-keytab = {
      #   source-file = files.service-keytabs.legatus.ipropd;
      #   target-file = "/run/heimdal/ipropd.keytab";
      #   user = config.fudo.auth.kdc.user;
      # };
    };

    client.dns = {
      ipv4 = true;
      ipv6 = true;
      user = "fudo-client";
      external-interface = "extif0";
    };

    # auth.kdc = {
    #   enable = true;
    #   realm = "FUDO.ORG";
    #   bind-addresses = [ host-ipv4 "127.0.0.1" ];
    #   master-key-file =
    #     secrets.heimdal-master-key.target-file;
    #   state-directory = "/state/kerberos";
    #   slave-config = {
    #    master-host = "france";
    #     ipropd-keytab = secrets.ipropd-keytab.target-file;
    #   };
    # };

    secure-dns-proxy = {
      enable = true;
      upstream-dns =
        [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
      bootstrap-dns = "1.1.1.1";
      listen-ips = [ "127.0.0.1" ];
      listen-port = 53;
      allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
    };

    dns.state-directory = "/state/nsd";
  };
}